AI 发现 PHP 两个严重漏洞，芬兰政府、爱丁堡议会和 BBC 等紧急下线网站

Published21 October 2026, 13:09 BSTUpdated 18 minutes ago

The Finnish government, Edinburgh council and the BBC are among those to have taken down sites and pages ahead of a software update to a programming language which underpins many online services.

Two critical vulnerabilities have been found with the PHP programming language, which is widely used across the internet. A fix was issued on Wednesday afternoon.

The flaws were discovered by AI, with cyber-security firm Wiz saying they were the "most severe vulnerabilities ever discovered" by the tech, which is reshaping the cyber landscape.

Multiple national cyber-security agencies have urged organisations to rapidly adopt the updates, or consider taking their websites offline.

Finland has temporarily shut down the government's public web services, while the Netherlands' cyber-security agency said it was taking its own website offline due to the vulnerabilities.

Meanwhile, the White House said federal agencies were assessing potential impacts to government systems and critical infrastructure, and it was working with leading AI labs to speed up a fix to the issue.

And in a post on X, external, Japan's Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP.

Edinburgh council's website has also become inaccessible, as well as the online homes for several BBC programmes including Doctor Who and The Traitors.

They have not confirmed a link to PHP - BBC News has approached them for comment.

Other websites, including the art platform DeviantArt, have said they are "temporarily down for maintenance, external" without specifying the reason.

The vulnerabilities were discovered by cyber-security researchers at the firms Calif and Wiz. They used state-of-the art AI, made by OpenAI, to find the flaws.

OpenAI said in a blog post, external it was "one of the most impactful security issues in recent memory".

According to the firms, they had gone undetected for more than a decade.

"Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours," Wiz said in a blog post.

It has estimated "roughly 70%" of the internet is affected, though the BBC is unable to verify that figure.

The Netherlands' National Institute for Public Health and the Environment, an agency of the Dutch government, has taken down its website.

Similarly the website of the Tweede Kamer, the lower house of the nation's parliament, has become inaccessible.

The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia have urged those who use PHP to apply the fixes.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note, external.

Japan's national cyber-security office and EU cyber-security officials have issued a similar warning, external.

'Early attacks emerging'

"PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful ⁠lot of software that doesn't even advertise that it runs PHP under the hood," cyber-security company Huntress said.

Cyber-security expert Don Smith, from the Sophos Counter Threat Unit, told the BBC this would "likely be a priority target" for hackers.

The immediate challenge was not simply installing a patch to fix the issue, but finding and managing every instance where PHP was running, he said.

"The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it," he said.

He said it was crucial that organisations looked out for signs that an attacker "might have already have gained a foothold".

The European Union Computer Emergency Response Team (CERT-EU) said the risk scores given to the vulnerabilities "indicate the potential for unauthenticated remote code execution".

Such a cyber-attack could potentially allow hackers to install malware and take down websites.

Dane Knecht, chief technology officer at internet infrastructure firm Cloudflare, said he was, external "seeing early attacks emerging and are updating mitigations as new vectors show up".

The NCSC said once organisations have installed the update, they should "continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP".

It is not yet clear which versions of the programming language are affected, but CERT-EU said it could affect all versions of it dating back to PHP 5 onwards - which launched in 2004.

The PHP Foundation has issued the update only for the latest versions however - with people using PHP 8.1 or older being urged to upgrade.

PHP was created for web development. It is used on servers to implement what you see when you visit websites.

Not all websites use it, but it nonetheless powers a large portion of the internet.

King warns malicious online actors are evolving tactics

Published10 October

UK cyber chiefs say it's time to ditch passwords for passkeys - what are they?

Published24 April